CVE-2025-65271

Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege escalation to an administrative account. Fixed in Azuriom 1.2.7.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/1337Skid/CVE-2025-65271	Third Party Advisory
https://github.com/Azuriom/Azuriom	Product
https://github.com/Azuriom/Azuriom/commit/0289175547319add814dcb526e8ba034f1ebc3ec	Patch
https://www.github.com/Azuriom/Azuriom	Product
https://www.github.com/Azuriom/Azuriom/commit/0289175547319add814dcb526e8ba034f1ebc3ec	Patch
https://github.com/1337Skid/CVE-2025-65271	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:azuriom:azuriom:*:*:*:*:*:*:*:*

History

18 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Inyección de plantillas del lado del cliente (CSTI) en el panel de administración de Azuriom CMS permite a un usuario con pocos privilegios ejecutar código de plantilla arbitrario en el contexto de la sesión de un administrador. Esto puede ocurrir a través de plugins o componentes del panel que renderizan entrada de usuario no confiable, lo que podría permitir la escalada de privilegios a una cuenta administrativa. Corregido en Azuriom 1.2.7.

Information

Published : 2025-12-08 19:15

Updated : 2026-10-18 14:10

NVD link : CVE-2025-65271

Mitre link : CVE-2025-65271

CVE.ORG link : CVE-2025-65271

JSON object : View

Products Affected

azuriom

azuriom

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-65271", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65271", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-09T20:04:14.340618Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-08T19:15:50.540", "references": [{"url": "https://github.com/1337Skid/CVE-2025-65271", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/Azuriom/Azuriom", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/Azuriom/Azuriom/commit/0289175547319add814dcb526e8ba034f1ebc3ec", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://www.github.com/Azuriom/Azuriom", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.github.com/Azuriom/Azuriom/commit/0289175547319add814dcb526e8ba034f1ebc3ec", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/1337Skid/CVE-2025-65271", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege escalation to an administrative account. Fixed in Azuriom 1.2.7."}, {"lang": "es", "value": "Inyecci\u00f3n de plantillas del lado del cliente (CSTI) en el panel de administraci\u00f3n de Azuriom CMS permite a un usuario con pocos privilegios ejecutar c\u00f3digo de plantilla arbitrario en el contexto de la sesi\u00f3n de un administrador. Esto puede ocurrir a trav\u00e9s de plugins o componentes del panel que renderizan entrada de usuario no confiable, lo que podr\u00eda permitir la escalada de privilegios a una cuenta administrativa. Corregido en Azuriom 1.2.7."}], "lastModified": "2026-10-18T14:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:azuriom:azuriom:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FA4582B-9014-408F-BEE7-3FEF69CC8667", "versionEndExcluding": "1.2.7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}